{"id":19402723,"url":"https://github.com/cscfi/c4gh-transit","last_synced_at":"2025-07-11T23:41:52.649Z","repository":{"id":220276178,"uuid":"746661998","full_name":"CSCfi/c4gh-transit","owner":"CSCfi","description":"c4gh-transit is a plugin for Hashicorp Vault used for storing crypt4gh encrypted file headers, and re-encrypting them with ephemeral encryption keys.","archived":false,"fork":false,"pushed_at":"2025-02-19T11:53:13.000Z","size":511,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-03-30T08:41:37.538Z","etag":null,"topics":["crypt4gh","vault"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CSCfi.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-01-22T13:12:29.000Z","updated_at":"2025-02-19T11:53:16.000Z","dependencies_parsed_at":"2024-03-01T07:23:38.592Z","dependency_job_id":"2a9bd21e-4f64-44dd-a833-e0ceb0d3614b","html_url":"https://github.com/CSCfi/c4gh-transit","commit_stats":null,"previous_names":["cscfi/c4gh-transit"],"tags_count":26,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CSCfi%2Fc4gh-transit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CSCfi%2Fc4gh-transit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CSCfi%2Fc4gh-transit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CSCfi%2Fc4gh-transit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CSCfi","download_url":"https://codeload.github.com/CSCfi/c4gh-transit/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251297326,"owners_count":21566797,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["crypt4gh","vault"],"created_at":"2024-11-10T11:25:28.724Z","updated_at":"2025-04-28T10:42:41.163Z","avatar_url":"https://github.com/CSCfi.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Vault Transit plugin for crypt4gh files\n**crypt4gh-vault-transit** is a plugin for **Hashicorp Vault** extending the\nsupport of the existing **Vault transit** with proper support for crypt4gh\nfiles. It adds key management by project/user level separation, whitelisted\ndownload access by public key, automatic key generation for crypt4gh keys\nalong with some other changes related to the file type. Plugin tries to re-use\nas much of the original plugin code as possible.\n\n## Download built binaries\n\nEach git tag triggers a release build that compiles and uploads binaries to configured binary repository.\n\nThere are compiled binaries available for x86_64 linux systems from `Artifactory`, where you can download the latest version.\n\nNote that it requires authentication to download.\n\n## Building\nThe binary must be build for the platform it will run in.\nEven though that might be obvious, there is only Alpine official docker vault image, see [source](https://github.com/hashicorp/vault/blob/main/scripts/docker/Dockerfile).\nAnd building locally in a development machine might not be compatible with the\nofficial image, there to be wider compability diabling CGO is used in building.\n\nNote: the docker images will not cache dependencies and build assets over subsequent builds with the configuration given below.\n\n### Building for the local environment\n\n```bash\nmkdir -p vault/plugins\ngo build -v -o vault/plugins/c4ghtransit c4ghtransit/cmd/c4ghtransit/main.go\n```\n\nWith the golang debian docker image\n```\ndocker run --rm \\\n    -u $(id -u):$(id -g) \\\n    --env XDG_CACHE_HOME=/tmp \\\n    -v ${PWD}/:/c4ghtransit \\\n    -w /c4ghtransit \\\n    golang:bullseye \\\n    go build -v -o /c4ghtransit/vault/plugins/c4ghtransit /c4ghtransit/c4ghtransit/cmd/c4ghtransit/main.go\n```\n\n### Building for Alpine\n\nWith local environment, so the binary will be statically linked, and will use a golang implementation of the networking library.\n\n    CGO_ENABLED=0 go build -tags netgo -a -v -o output/c4ghtransit-alpine c4ghtransit/cmd/c4ghtransit/main.go\n\nWith the golang docker alpine image\n```\ndocker run --rm \\\n    -u $(id -u):$(id -g) \\\n    --env XDG_CACHE_HOME=/tmp \\\n    -v ${PWD}/:/c4ghtransit \\\n    -w /c4ghtransit \\\n    golang:1.21-alpine \\\n    go build -v -o /c4ghtransit/vault/plugins/c4ghtransit /c4ghtransit/c4ghtransit/cmd/c4ghtransit/main.go\n```\n\n## Running with the vault server\n\n### In local environment\nInstall vault: https://developer.hashicorp.com/vault/downloads\n\nThen run the script provided to start a vault server with the plugin enabled and configured.\n\n    ./dev-tools/vault.sh\n\n### With docker Alpine image\n\nThe commands below assume that the plugin binary exists at `./vault/plugins/c4ghtransit`\n\n```\ndocker run --rm \\\n    --name=dev-vault \\\n    -e 'VAULT_DEV_ROOT_TOKEN_ID=devroot' \\\n    -e 'VAULT_LOCAL_CONFIG={\"storage\": {\"file\": {\"path\": \"/vault/data\"}}, \"disable_mlock\": true, \"ui\": true}' -p 8200:8200 \\\n    -v ${PWD}/vault/plugins:/vault/plugins \\\n    hashicorp/vault:latest \\\n    server -dev -dev-plugin-dir=/vault/plugins\n```\n\n## Usage\nLogin to dev server, and enable the plugin\n```bash\nexport VAULT_ADDR='http://127.0.0.1:8200'\nvault login token=devroot\nvault secrets enable c4ghtransit\n```\n\nAfter this, you can e.g. create a new key with\n```bash\nvault write c4ghtransit/keys/test-user\n```\n\n### Updating Vault Plugin\n\nsee what version is currently running\n```bash\nvault secrets list -detailed\n```\n\ncopy the new binary to plugins folder\n```bash\nmv c4ghtransit-\u003cversion\u003e /vault/plugins-folder\nchmod +x /vault/plugins-folder/c4ghtransit-\u003cversion\u003e\nchown vault:vault /vault/plugins-folder/c4ghtransit-\u003cversion\u003e\n```\n\nArtifactory provides checksums for their binaries. Select a binary [from this page](https://sds-docker.artifactory.ci.csc.fi/artifactory/webapp/#/artifacts/browse/tree/General/sds-generic-local/c4gh-transit/c4ghtransit), find the checksum on the right-hand side, at the bottom under \"Checksums\".\n\nGithub Release also provides the artifacts for download.\n\nOtherwise, calculate the checksum with `sha256sum c4ghtransit-\u003cversion\u003e`.\n\nregister the plugin\n```bash\nvault plugin register -sha256=\u003cchecksum\u003e -command=c4ghtransit-\u003cversion\u003e -version=\u003cversion\u003e secret c4ghtransit\n\nvault secrets tune -plugin-version=\u003cversion\u003e c4ghtransit\n\nvault plugin reload -plugin c4ghtransit\nvault secrets list -detailed\n```\n## Tests\nThere are acceptance and stress tests, which run in Docker. They can be run with\n\n    go test -v ./c4ghtransit\n\n## Docs\nThe `c4ghtransit` plugin is well documented, having its api documented using Vault's plugin SDK. There are different ways\nto extract and visualize such information.\n\n### Vault API Explorer\nVault provides API docs generated in the OpenAPI format. You can access it by opening\n`http://localhost:8200/ui/vault/tools/api-explorer` in the browser.\nLogin with the token `devroot`. In the **filter** textbox, write `c4ghtransit` to see only endpoints of the plugin.\n\n### C4ghtransit plugin OpenAPI JSON files\nAn OpenAPI json file can be generated by running `./dev-tools/generate_openapi.sh`.\nThe file will be at `dev-tools/openapi.json`. You can copy its contents into the\n[Swagger editor](https://editor.swagger.io/) to visualize it.\n\n### Vault API help\nVault API provide help docs at `http://127.0.0.1:8200/v1/c4ghtransit?help=1`\n\n    $ curl -sL \\\n    -H \"X-Vault-Token: devroot\" \\\n    http://127.0.0.1:8200/v1/c4ghtransit?help=1 | jq\n\n### Vault cli help\nAnd the cli command [`path-help`](https://developer.hashicorp.com/vault/docs/commands/path-help)\ncan also be used to get information about each path.\n\n## Licensing\n\n`c4gh-transit` is licensed under MIT license.\nSeveral sections that are licensed under MRL-2.0 have been flagged in the source code.\n\n`SPDX-License-Identifier: MIT AND MPL-2.0`\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcscfi%2Fc4gh-transit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcscfi%2Fc4gh-transit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcscfi%2Fc4gh-transit/lists"}